1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
|
import type { AuthenticationResponseJSON } from '@simplewebauthn/server/script/deps';
import type { VercelRequest, VercelResponse } from '@vercel/node';
import generateAuthenticationOptions from './_generateAuthenticationOptions';
import { getFirstQueryParam } from '_getFirstQueryParam';
import getUser from 'db/_getUser';
import setCurrentChallenge from 'db/_setCurrentChallenge';
import getCurrentChallenge from 'db/_getCurrentChallenge';
import verifyAuthenticationResponse from './_verifyAuthenticationResponse';
import updateAuthenticator from 'db/_updateAuthenticator';
import getAuthenticators from 'db/_getAuthenticators';
/**
* # authentication
*
* ## GET
*
* Generates authentication options.
*
* ### Parameters
*
* - `userId: string`. A user must exist with this ID.
*
* ### Responses
*
* - `200 OK`: Authentication options. Client should consume these using
* \@simplewebauthn/browser’s `startAuthentication()` method.
* - `400 BAD REQUEST`: No `userId` was provided.
* - `404 NOT FOUND`: No user exists with the provided `userId`.
*
* ## POST
*
* Verifies authentication response from \@simplewebauthn/browser’s
* `startAuthentication()` method.
*
* ### Parameters
*
* - `userId: string`. A user must exist with this ID, and must have an
* existing challenge and at least one authenticator in the database.
* - `authenticationResponse: AuthenticationResponseJSON`. The response from
* \@simplewebauthn/browser’s `startAuthentication()` method.
*
* ### Responses
*
* - `200 OK`: Returns a boolean string. `'true'` if verification was
* successful, and `'false'` otherwise.
* - `400 BAD REQUEST`: No `userId` was provided.
* - `404 NOT FOUND`: No user exists with the provided `userId`.
* - `500 INTERNAL SERVER ERROR`: The user with the provided `userId` did not
* have any existing challenges or authenticators in the database.
* - `501 NOT IMPLEMENTED`: The user with the provided `userId` had more than
* one authenticator in the database. This is not yet supported.
*/
export default async function handler(request: VercelRequest, response: VercelResponse): Promise<void> {
if (request.method === 'GET') {
(await handleGet(request))(response);
return;
}
else if (request.method === 'POST') {
(await handlePost(request))(response);
return;
}
}
async function handleGet(request: VercelRequest): Promise<(r: VercelResponse) => void> {
const userId = getFirstQueryParam('userId', request.query);
if (!userId) {
return (response) => void (
response.status(400).send('Expected body to contain userId, but none provided.')
);
}
const user = await getUser(userId);
if (!user) {
return (response) => void (
response.status(404).send(`
Failed to generate authentication options because there was no user
with the ID ${userId}.
`)
);
}
const options = await generateAuthenticationOptions(user);
await setCurrentChallenge(user.id, options.challenge);
return (response) => void response.json(options);
}
async function handlePost(request: VercelRequest): Promise<(r: VercelResponse) => void> {
type Body = {
userId: string;
authenticationResponse: AuthenticationResponseJSON;
};
const { userId, authenticationResponse }: Body = request.body;
if (!userId) {
return (response) => void (
response.status(400).send('Expected body to contain userId, but none provided.')
);
}
if (!authenticationResponse) {
return (response) => void (
response.status(400).send('Expected body to contain authenticationResponse, but none provided.')
);
}
const user = await getUser(userId);
if (!user) {
return (response) => void (
response.status(404).send(`
Failed to verify authentication response because no user existed with
ID ${userId}.
`)
);
}
const expectedChallenge = await getCurrentChallenge(userId);
if (!expectedChallenge) {
return (response) => void (
response.status(500).send(`
Failed to verify authentication response because user with ID ${userId}
did not have any existing challenges in the database.
`)
);
}
const authenticators = await getAuthenticators(user.id, ['id', 'publicKey', 'counter', 'transports']);
if (!authenticators || authenticators.length === 0) {
return (response) => void (
response.status(500).send(`
Failed to verify authentication response because user with ID ${userId}
did not have any authenticators in the database.
`)
);
} else if (authenticators.length > 1) {
// TODO: implement support for multiple authenticators
return (response) => void (
response.status(501).send(`
Failed to verify authentication response because user with ID ${userId}
had more than one authenticator in the database. We only currently
support a single authenticator per user.
`)
);
}
const isVerified = await verifyAuthenticationResponse(
authenticators[0],
authenticationResponse,
expectedChallenge
);
if (isVerified) {
for (const authenticator of authenticators) {
updateAuthenticator(authenticator.id, { counter: authenticator.counter + 1 });
}
}
return (response) => void (
response.status(200).send(isVerified ? 'true' : 'false')
);
}
|
